Alibaba Cloud ECS: Deploy and Manage Virtual Machines at Scale

ECS Instance Families

Alibaba Cloud ECS (Elastic Compute Service) organizes instances into families based on use case:

Family	vCPU:Memory	Use Case
c7	1:2	Compute-intensive (web servers, CI/CD)
g7	1:4	General purpose (most web apps)
r7	1:8	Memory-intensive (databases, Redis)
i3	1:4	Local NVMe SSD (latency-sensitive I/O)
hpc7	1:4	HPC with RDMA networking
gn7	1:4 + GPU	Machine learning inference
e	1:8	Burstable baseline CPU (dev/test)

The number suffix indicates the CPU architecture generation. c7 uses Intel Ice Lake, c8 uses Intel Sapphire Rapids. Always prefer the latest generation for best price-performance.

Instance naming: ecs.c7.2xlarge = c7 family, 2xlarge size (8 vCPU, 16 GB RAM).

---

Launch an ECS Instance

# Install Alibaba Cloud CLI
curl -O https://aliyunidaas-us-east-1.oss-us-east-1.aliyuncs.com/aliyun-cli/aliyun-linux-amd64-latest.tgz
tar -xzf aliyun-linux-amd64-latest.tgz && sudo mv aliyun /usr/local/bin/
aliyun configure

# Create a VPC
aliyun vpc CreateVpc \
  --RegionId ap-southeast-1 \
  --CidrBlock 10.0.0.0/16 \
  --VpcName production-vpc

# Create a VSwitch (subnet)
aliyun vpc CreateVSwitch \
  --RegionId ap-southeast-1 \
  --ZoneId ap-southeast-1a \
  --VpcId vpc-xxx \
  --CidrBlock 10.0.1.0/24 \
  --VSwitchName production-vsw-a

# Create a security group
aliyun ecs CreateSecurityGroup \
  --RegionId ap-southeast-1 \
  --VpcId vpc-xxx \
  --SecurityGroupName web-sg

# Allow HTTP/HTTPS
aliyun ecs AuthorizeSecurityGroup \
  --RegionId ap-southeast-1 \
  --SecurityGroupId sg-xxx \
  --IpProtocol tcp \
  --PortRange 80/80 \
  --SourceCidrIp 0.0.0.0/0

aliyun ecs AuthorizeSecurityGroup \
  --RegionId ap-southeast-1 \
  --SecurityGroupId sg-xxx \
  --IpProtocol tcp \
  --PortRange 443/443 \
  --SourceCidrIp 0.0.0.0/0

# Launch an instance
aliyun ecs RunInstances \
  --RegionId ap-southeast-1 \
  --ZoneId ap-southeast-1a \
  --InstanceType ecs.c7.2xlarge \
  --ImageId ubuntu_22_04_x64_20G_alibase_20231221.vhd \
  --SecurityGroupId sg-xxx \
  --VSwitchId vsw-xxx \
  --SystemDisk.Category cloud_essd \
  --SystemDisk.Size 100 \
  --SystemDisk.PerformanceLevel PL1 \
  --InstanceName web-server-01 \
  --Password "SecureP@ssword123" \
  --InternetMaxBandwidthOut 10

---

Terraform Configuration

# main.tf
provider "alicloud" {
  region = "ap-southeast-1"
}

# VPC
resource "alicloud_vpc" "main" {
  vpc_name   = "production-vpc"
  cidr_block = "10.0.0.0/16"
}

resource "alicloud_vswitch" "zone_a" {
  vpc_id       = alicloud_vpc.main.id
  cidr_block   = "10.0.1.0/24"
  zone_id      = data.alicloud_zones.available.zones[0].id
  vswitch_name = "production-vsw-a"
}

resource "alicloud_vswitch" "zone_b" {
  vpc_id       = alicloud_vpc.main.id
  cidr_block   = "10.0.2.0/24"
  zone_id      = data.alicloud_zones.available.zones[1].id
  vswitch_name = "production-vsw-b"
}

data "alicloud_zones" "available" {
  available_resource_creation = "Instance"
}

# Security group
resource "alicloud_security_group" "web" {
  name   = "web-sg"
  vpc_id = alicloud_vpc.main.id
}

resource "alicloud_security_group_rule" "http" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "80/80"
  priority          = 1
  security_group_id = alicloud_security_group.web.id
  cidr_ip           = "0.0.0.0/0"
}

resource "alicloud_security_group_rule" "https" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "443/443"
  priority          = 1
  security_group_id = alicloud_security_group.web.id
  cidr_ip           = "0.0.0.0/0"
}

# ECS instance
resource "alicloud_instance" "web" {
  count = 2

  instance_name        = "web-server-${count.index + 1}"
  availability_zone    = count.index == 0 ? alicloud_vswitch.zone_a.zone_id : alicloud_vswitch.zone_b.zone_id
  instance_type        = "ecs.c7.2xlarge"
  image_id             = "ubuntu_22_04_x64_20G_alibase_20231221.vhd"
  vswitch_id           = count.index == 0 ? alicloud_vswitch.zone_a.id : alicloud_vswitch.zone_b.id
  security_groups      = [alicloud_security_group.web.id]

  system_disk_category          = "cloud_essd"
  system_disk_size              = 100
  system_disk_performance_level = "PL1"

  internet_max_bandwidth_out = 0  # No public IP for instances behind SLB

  user_data = base64encode(<<-EOF
    #!/bin/bash
    apt-get update -y
    apt-get install -y nginx
    systemctl enable nginx
    systemctl start nginx
    echo "Server ${count.index + 1}" > /var/www/html/index.html
  EOF
  )

  tags = {
    Role        = "web"
    Environment = "production"
  }
}

---

Custom Images (Gold Images)

Create a custom image from a configured instance — the Alibaba Cloud equivalent of an AMI:

# Stop instance (optional but recommended for consistent state)
aliyun ecs StopInstance --InstanceId i-xxx

# Create image
aliyun ecs CreateImage \
  --InstanceId i-xxx \
  --ImageName production-base-20260405 \
  --Description "Ubuntu 22.04 with Nginx, Docker, and security hardening"

# List available images
aliyun ecs DescribeImages \
  --ImageOwnerAlias self \
  --RegionId ap-southeast-1

# Copy image to another region
aliyun ecs CopyImage \
  --RegionId ap-southeast-1 \
  --ImageId m-xxx \
  --DestinationRegionId cn-hangzhou \
  --DestinationImageName production-base-cn-20260405

---

Auto Scaling Groups

Automatically add/remove instances based on load:

# Terraform Auto Scaling configuration
resource "alicloud_ess_scaling_group" "web" {
  min_size           = 2
  max_size           = 20
  scaling_group_name = "web-asg"

  vswitch_ids = [
    alicloud_vswitch.zone_a.id,
    alicloud_vswitch.zone_b.id,
  ]

  # Remove from SLB load balancer when scaling down
  loadbalancer_ids = [alicloud_slb_load_balancer.web.id]

  removal_policies = ["OldestScalingConfiguration", "OldestInstance"]
  health_check_type = "LoadBalancer"
}

resource "alicloud_ess_scaling_configuration" "web" {
  scaling_group_id  = alicloud_ess_scaling_group.web.id
  instance_type     = "ecs.c7.2xlarge"
  image_id          = "ubuntu_22_04_x64_20G_alibase_20231221.vhd"
  security_group_id = alicloud_security_group.web.id

  system_disk_category = "cloud_essd"
  system_disk_size     = 100

  user_data = base64encode(<<-EOF
    #!/bin/bash
    # Bootstrap script to join application
    /opt/bootstrap.sh
  EOF
  )

  active = true
}

# Scale-out alarm: add instances when CPU > 70%
resource "alicloud_ess_alarm" "cpu_high" {
  name             = "web-cpu-high"
  description      = "Scale out when CPU > 70%"
  alarm_task_id    = alicloud_ess_scaling_rule.scale_out.ari
  scaling_group_id = alicloud_ess_scaling_group.web.id
  metric_type      = "system"
  metric_name      = "CpuUtilization"
  period           = 60
  statistics       = "Average"
  threshold        = 70
  comparison_operator = ">="
  evaluation_count = 3
}

resource "alicloud_ess_scaling_rule" "scale_out" {
  scaling_group_id = alicloud_ess_scaling_group.web.id
  scaling_rule_type = "TargetTrackingScalingRule"
  target_value      = 70
  metric_name       = "CpuUtilizationHigherLevel"
}

---

Server Load Balancer (SLB)

SLB distributes traffic across ECS instances:

resource "alicloud_slb_load_balancer" "web" {
  load_balancer_name   = "web-slb"
  address_type         = "internet"  # or "intranet" for internal
  load_balancer_spec   = "slb.s3.large"
  vswitch_id           = alicloud_vswitch.zone_a.id
  payment_type         = "PayAsYouGo"
  internet_charge_type = "PayByTraffic"
}

resource "alicloud_slb_backend_server" "web" {
  load_balancer_id = alicloud_slb_load_balancer.web.id

  dynamic "backend_servers" {
    for_each = alicloud_instance.web
    content {
      server_id = backend_servers.value.id
      weight    = 100
    }
  }
}

resource "alicloud_slb_listener" "http" {
  load_balancer_id  = alicloud_slb_load_balancer.web.id
  backend_port      = 80
  frontend_port     = 80
  bandwidth         = -1  # Unlimited
  protocol          = "http"
  sticky_session    = "off"
  health_check      = "on"
  health_check_uri  = "/health"
  health_check_http_code = "http_2xx,http_3xx"
}

---

Preemptible Instances (Spot)

Alibaba Cloud's Spot instances are called "preemptible instances" — up to 90% discount, with 5-minute notice before reclaim:

aliyun ecs RunInstances \
  --RegionId ap-southeast-1 \
  --InstanceType ecs.c7.2xlarge \
  --ImageId ubuntu_22_04_x64_20G_alibase_20231221.vhd \
  --SpotStrategy SpotAsPriceGo \  # Bid at market price
  --SpotDuration 0 \               # 0 = no maximum duration
  --VSwitchId vsw-xxx \
  --SecurityGroupId sg-xxx

Use preemptible instances for:

• CI/CD build agents
• Batch data processing
• Non-critical background jobs

In Terraform:

resource "alicloud_instance" "spot_worker" {
  # ... standard config ...
  spot_strategy = "SpotAsPriceGo"
  spot_price_limit = "0"  # 0 means bid at current market price
}

---

Disk Types and Performance

Disk Type	IOPS	Throughput	Use Case
cloud_efficiency	3000	140 MB/s	Dev/test, low-cost
cloud_ssd	25000	300 MB/s	General production
cloud_essd (PL0)	10000	180 MB/s	Good baseline
cloud_essd (PL1)	50000	350 MB/s	Most production workloads
cloud_essd (PL2)	100000	750 MB/s	High-performance databases
cloud_essd (PL3)	1000000	4000 MB/s	Extreme I/O

Always use cloud_essd PL1 as the default for production ECS instances. The cost difference over cloud_efficiency is small compared to the performance gain.

Expand a disk without stopping the instance:

aliyun ecs ResizeDisk \
  --DiskId d-xxx \
  --NewSize 200 \
  --Type online

# Then extend the partition inside the OS
growpart /dev/vda 1
resize2fs /dev/vda1